cat>{{KUBE_CONF}}/token.csv<<EOF
$(head -c 16 /dev/urandom | od -An -t x | tr -d ' '),kubelet-bootstrap,10001,"system:kubelet-bootstrap"
EOF
KUBE_APISERVER_OPTS="--logtostderr=true \
--v=4 \
--etcd-servers=https://{{ groups.etcd[0] }}:2379,https://{{ groups.etcd[1] }}:2379,https://{{ groups.etcd[2] }}:2379 \
--bind-address={{ groups.etcd[0] }} \
--secure-port=6443 \
--advertise-address={{ groups.etcd[0] }} \
--allow-privileged=true \
--service-cluster-ip-range=10.0.0.0/24 \
--enable-admission-plugins=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota,NodeRestriction \
--authorization-mode=RBAC,Node \
--enable-bootstrap-token-auth \
--token-auth-file={{KUBE_CONF}}/token.csv \
--service-node-port-range=30000-50000 \
--tls-cert-file={{KUBE_CONF}}/ssl/server.pem  \
--tls-private-key-file={{KUBE_CONF}}/ssl/server-key.pem \
--client-ca-file={{KUBE_CONF}}/ssl/ca.pem \
--service-account-key-file={{KUBE_CONF}}/ssl/ca-key.pem \
--etcd-cafile=/etc/etcd/ssl/ca.pem \
--etcd-certfile=/etc/etcd/ssl/server.pem \
--etcd-keyfile=/etc/etcd/ssl/server-key.pem"

# Create a kube-apiserver configuration file.
cat >{{KUBE_API_CONF}}<<EOF
KUBE_APISERVER_OPTS=$KUBE_APISERVER_OPTS
EOF

# Create the kube-apiserver service.
cat>/usr/lib/systemd/system/kube-apiserver.service<<EOF
[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/kubernetes/kubernetes
After=etcd.service
Wants=etcd.service

[Service]
EnvironmentFile={{ KUBE_API_CONF }}
ExecStart=/usr/local/bin/kube-apiserver \
$KUBE_APISERVER_OPTS
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF
